Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Dec. 4, 2023, 5:58 p.m.	Dec. 4, 2023, 6:29 p.m.

Size	43.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`87e782c7ef3f46a86d7df12b399d6fcb`
SHA256	`fe9be947238b7d3c842a9890df865ea732a9e75bd0f5f33bfeb9878d52f40720`
CRC32	`AE509FA8`
ssdeep	`96:UFZm8MrZxiMBSndI4H5kdc6PkBNNlRGGadekHytUZfLJh6OZZR/YmWZrzNt:UeR1bBcI/G7qfLJh6OZ4mWD`
PDB Path	C:\Users\UNKNOWN\Desktop\illegalprojeninslnsi\VisualStudio\obj\Debug\VisualStudio.pdb
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description)

Stealer%20Resou%E2%80%AEnls.scr "C:\Users\test22\AppData\Local\Temp\Stealer%20Resou%E2%80%AEnls.scr"
1932

Name	Response	Post-Analysis Lookup
img.guildedcdn.com	A 54.192.175.75 A 54.192.175.50 A 54.192.175.27 CNAME du4l1tjneafke.cloudfront.net A 54.192.175.65	54.192.175.27

IP Address	Status	Action
164.124.101.2	Active	Moloch
54.192.175.50	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49161 -> 54.192.175.50:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 4, 2023, 5:58 p.m.			0	0
IsDebuggerPresent Dec. 4, 2023, 5:58 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\UNKNOWN\Desktop\illegalprojeninslnsi\VisualStudio\obj\Debug\VisualStudio.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 4, 2023, 5:58 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00905000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0090b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00907000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:58 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 4, 2023, 5:59 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Dec. 4, 2023, 5:59 p.m.	flags: 15 family: 0		111	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Convagent.m!c
MicroWorld-eScan	IL:Trojan.MSILZilla.39856
FireEye	IL:Trojan.MSILZilla.39856
Skyhigh	RDN/genericac
ALYac	IL:Trojan.MSILZilla.39856
Malwarebytes	Trojan.Downloader.MSIL.Generic
Zillya	Backdoor.Crysan.Win32.7093
Sangfor	Downloader.Msil.Zilla.Vakc
K7AntiVirus	Trojan-Downloader ( 005aed771 )
Alibaba	Backdoor:MSIL/Zilla.0dc5993e
K7GW	Trojan-Downloader ( 005aed771 )
BitDefenderTheta	Gen:NN.ZemsilF.36608.cm0@aeuhZco
VirIT	Trojan.Win32.Genus.UHR
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.PXX
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Backdoor.MSIL.Convagent.gen
BitDefender	IL:Trojan.MSILZilla.39856
Avast	Win32:DropperX-gen [Drp]
Tencent	Malware.Win32.Gencirc.13f863ed
Emsisoft	IL:Trojan.MSILZilla.39856 (B)
F-Secure	Trojan.TR/Dldr.Agent.qougu
VIPRE	IL:Trojan.MSILZilla.39856
TrendMicro	TROJ_GEN.R014C0DL123
Sophos	Generic Reputation PUA (PUA)
Ikarus	Trojan.Win32.Agent
GData	IL:Trojan.MSILZilla.39856
Webroot	W32.Dropper.Gen
Avira	TR/Dldr.Agent.qougu
MAX	malware (ai score=81)
Kingsoft	malware.kb.c.818
Gridinsoft	Trojan.Win32.Agent.sa
Xcitium	Malware@#sfxdraljcuh4
Arcabit	IL:Trojan.MSILZilla.D9BB0
ViRobot	Trojan.Win.Z.Agent.44032.SC
ZoneAlarm	HEUR:Backdoor.MSIL.Convagent.gen
Microsoft	Trojan:MSIL/Zilla.AMBE!MTB
Varist	W32/ABRisk.JAMO-7918
AhnLab-V3	Dropper/Win.DropperX-gen.C5542487
McAfee	RDN/genericac
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R014C0DL123
Rising	Downloader.Tiny!8.245 (CLOUD)
Fortinet	MSIL/Agent.PXX!tr.dldr
AVG	Win32:DropperX-gen [Drp]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

Stealer%20Resou%E2%80%AEnls.scr

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All